← 返回 Skills 市场

AI Fortune Teller

Name: AI Fortune Teller
Author: jackjls

作者姜AGI · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install ai-fortune-teller

功能描述

AI玄学大师 - 八字命理、塔罗占卜、运势分析。基于传统命理典籍与现代AI技术融合的智能占卜工具。

使用说明 (SKILL.md)

AI玄学大师 🔮

智能命理占卜工具，融合传统命理典籍与现代AI技术。

功能模块

1. 八字命理分析

输入：出生年月日时（农历/公历）输出：四柱八字、十神格局、大运流年、事业/财运/婚姻/健康分析

2. 塔罗占卜

输入：占卜问题输出：牌阵解读、正逆位含义、指引建议

3. 每日运势推送

输入：出生信息（可选）输出：综合运势、事业/爱情/健康/财运评级 + 建议

4. 人生K线图 ✅

输入：八字命盘输出：可视化运势曲线图（股票K线风格）实现：MiniMax image-01 模型生成

5. 前世画像 ✅

输入：出生年月输出：AI生成前世画像 + 灵魂特质解读实现：MiniMax image-01 + 八字五行推演

6. 未来伴侣画像 ✅

输入：出生年月 + 性别输出：AI生成理想伴侣画像 + 命盘特征解读实现：MiniMax image-01 + 配偶星推演

使用方式

八字分析

【八字命理分析】
姓名：XXX
性别：X
出生地：XXX省XXX市
公历出生日期：XXXX年X月X日
出生时间：X时
（可选）农历出生日期：XXXX年X月X日

塔罗占卜

【塔罗占卜】
问题：XXX
牌阵：单张/三张/凯尔特十字/其他
（可选）抽到的牌：XXX

运势查询

【今日/本周/本月运势】
姓名：XXX（可选）
出生年月日：XXXX年X月X日（可选）
需要分析的方向：事业/爱情/财运/健康/综合

技术实现

命理提示词：参考《穷通宝鉴》《滴天髓》《渊海子平》《三命通会》等典籍
AI模型：MiniMax API（支持function call + 对话记忆）
可视化：MiniMax 图片生成 API
数据存储：本地JSON（用户命盘数据）

定价（未来）

版本	功能	价格
免费版	单次八字基础分析	¥0
基础版	八字+塔罗+运势	¥99/年
进阶版	全功能 + 人生K线图	¥199/年
定制版	私人命理师 + 无限咨询	¥999/年

合规声明

本工具仅提供娱乐性质命理分析，不构成专业命理建议。运势结果仅供参考，人生决策请理性判断。

安全使用建议

Before installing or running this skill: 1) Know that the bundled scripts call an external MiniMax API and expect MINIMAX_API_KEY (and optionally MINIMAX_API_HOST) even though the skill metadata does not declare it—if you don't set the key the scripts will fail. 2) The shell script sources and exports everything in $HOME/.clawd/.env; review that file first (it could contain other credentials) or run the skill in an isolated account/container to avoid exposing unrelated secrets. 3) Ensure your environment has curl, jq, and Python3 available as the scripts call them but the skill doesn't declare those binaries. 4) Understand that personal data (names, birth dates, birthplace) are sent to the external API endpoints—if that is sensitive, consider not using or use throwaway data. 5) If you proceed, supply only a dedicated MiniMax API key you can revoke and run the scripts in a sandboxed environment; request the author to update the skill metadata to declare required env vars and runtime binaries (MINIMAX_API_KEY, MINIMAX_API_HOST, curl, jq, python3) and to stop exporting arbitrary .clawd/.env content.

功能分析

Type: OpenClaw Skill Name: ai-fortune-teller Version: 1.0.0 The skill bundle contains a critical shell injection vulnerability in 'scripts/fortune.sh'. User-provided data (such as name or birth info) is interpolated into a double-quoted string within a 'curl' command's JSON payload, allowing for Remote Code Execution (RCE) via shell expansion (e.g., using backticks or $() syntax). Additionally, 'scripts/fortune.sh' contains several syntax errors in its 'jq' parsing logic (extra closing braces). While these flaws appear to be unintentional bugs rather than deliberate malware, they pose a significant security risk to the host environment.

能力评估

⚠ Purpose & Capability

The skill claims to run as an instruction-only fortune-teller and the features (八字、塔罗、K线图、画像) align with the included scripts. However, the registry metadata and SKILL.md declare no required environment variables or binaries, while the bundled scripts clearly require a MiniMax API key (MINIMAX_API_KEY / MINIMAX_API_HOST) and expect utilities like curl, jq, and Python. That mismatch suggests the metadata is incomplete and/or misleading.

⚠ Instruction Scope

SKILL.md tells the user to call the agent via chat or configure an API key for standalone use, but the actual scripts (scripts/fortune.sh, kline_generator.py, portrait_generator.py) do more: they read a local ~/.clawd/.env file and export its contents, call remote MiniMax endpoints with user-provided personal data (names, birth dates), and write output to /tmp. Reading and exporting a whole .clawd/.env is scope creep (may load unrelated secrets). The scripts also assume local CLI tools (curl, jq) and Python runtime availability that the skill metadata does not declare.

✓ Install Mechanism

There is no remote install step or download from external URLs; the skill is instruction-only with bundled scripts, so there is no high-risk install mechanism. Files included are local scripts and markdown; nothing is fetched from arbitrary third-party URLs during install.

⚠ Credentials

The skill metadata lists no required env vars, but the code requires MINIMAX_API_KEY (and optional MINIMAX_API_HOST). The fortune.sh script loads and exports all variable lines from $HOME/.clawd/.env, which can inadvertently expose unrelated secrets stored there. Requiring an API key for the external MiniMax service is reasonable for functionality, but failing to declare that requirement and reading a shared .env file are disproportionate and risky.

✓ Persistence & Privilege

The skill does not request always:true and can be invoked by the user only. It writes output files (e.g., /tmp/kline_<name>_YYYYMMDD.json) and calls external APIs, but it does not modify other skills or system-wide configuration. File writes to /tmp and local JSON storage are normal for this type of tool.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install ai-fortune-teller
安装完成后，直接呼叫该 Skill 的名称或使用 /ai-fortune-teller 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release with 6 modules: Bazi, Tarot, Fortune, K-line chart, Past life portrait, Future partner portrait

元数据

Slug ai-fortune-teller

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题